How do we protect backup servers on the network?
Treat them as the most valuable systems you have, because after an attack they are. Put the backup system in its own network segment and allow only the connections it needs: backup traffic from the systems it protects and management access from a small number of admin workstations. Close remote desktop and file sharing on the backup server unless they are strictly required, and never use it for browsing or e-mail. Patch its operating system and backup software quickly; backup products themselves have had serious vulnerabilities exploited by ransomware actors. Use separate admin accounts with MFA, keep the server out of the main domain where you can, and keep at least one copy immutable or offline. Finally, watch it: new hosts connecting to it, connections at unusual times and large reads from the backup storage by machines other than the backup server are all signs worth investigating, and all of them are visible in network traffic.